
Farhan Farrukh
Reverse Engineer, Pentester, Malware Analyst, OSCP CEH eJPT
Competenze

Consulta i miei servizi


Esperienza lavorativa
Lead Penetration Tester
TLC • Full time
Mar 2024 - Oct 2025 • 1 yr 7 mos
As the Lead Penetration Tester at TLC, I architect and execute offensive security operations that replicate real attacker behavior, not just textbook vulnerabilities. I design targeted attack paths, hunt for logic flaws, and uncover weaknesses hidden deep in authentication flows, API trust zones, and complex system interactions. My work focuses on building exploit chains, stress-testing security controls, and revealing high-impact risks that directly affect business integrity. I oversee testing strategy, guide junior testers, and ensure every engagement includes actionable, engineering-ready remediation steps. I collaborate with leadership to translate adversarial findings into strategic security improvements, helping the organization evolve from reactive fixes to proactive defense. This role elevates my ability to think like a determined threat actor and deliver precision-targeted penetration testing that strengthens real-world resilience. less
Cybersecurity Analyst | Application Security & Vulnerability Research
Z Systems Ltd • Full time
Jan 2022 - Feb 2024 • 2 yrs 1 mo
At Z Systems, I focused on web application security, vulnerability research, and attack-surface analysis across multiple enterprise platforms. I performed penetration testing (XSS, IDOR, auth flaws, API issues) conducted threat modeling, and analyzed logic vulnerabilities in critical modules. Built custom recon and automation tools in Python/Bash, reviewed code for insecure patterns, and helped engineering teams apply secure coding and OWASP based fixes. Delivered clear technical reports aligned with MITRE ATT&CK and CWE standards. This role strengthened my expertise in AppSec, exploit analysis, red-team methodologies, and reverse-engineering-driven debugging, directly shaping my offensive security approach today.
Offensive Security Engineer
IEC • Part time
Feb 2023 - Aug 2023 • 6 mos
At IEC, I worked across the full stack with a focus on identifying and eliminating security weaknesses in web applications. I analyzed frontend logic, backend APIs, authentication flows, and server behavior to uncover vulnerabilities such as XSS, IDOR, CSRF, insecure session handling, and broken access control. Developed and enhanced modules using JavaScript, Node.js, and modern frameworks, while performing security reviews, threat modeling, and code audits aligned with OWASP, CWE, and secure coding standards. Built scripts to test endpoints, validate access boundaries, and detect misconfigurations. This role strengthened my core skills in AppSec, vulnerability analysis, pentesting mindset, and exploit-driven debugging, directly shaping my offensive security and red-team approach today.